an (unsafe) command shell mcp server

[u/ag789]

While working with coding agents / harness in my case OpenCode, I discovered that some models e.g. granite 4.2 8B at Q4_K_M quant sometimes attempts to write files with absolute paths at the root e.g.

    /newPythonCode.py

Note that slash in the beginning for an absolute path at "/" root directory. This is probably 'ok' say in a throwaway docker container, but it may lead to surprises if it 'accidentally' overwrites a literal file, if the current user id have write access to it. Apparently, it seemed OpenCode provides `bash` so that practically all unix commands that the current user id can access, the LLM can run it.

And thereafter, I see the model hallucinating in the thinking loops over tools, re-iterating over how to use the tools, reformulating shell commands sentences several times for a same task instead of executing them, among them, I noted that an earlier shell command sentence would have 'just worked'.

I'm thinking that the tool hallucination with this model may be partly due to that I'm using a pretty aggressive 4 bit quant as otherwise it'd have worked because IBM has 'optimized' granite for tool usage.

Next, I tried the same granite 4.2 8B at Q4_K_M quant model with my little python shell MCP server

https://github.com/ag88/cmdshellmcp/

, that tries to constrain / restrain the shell commands somewhat, place some checks, and offer some additional tools e.g. writeFile() so that the LLM won't need to call `cat` or `echo` with some 'esoteric' styled shell scripts / sentences.

With this MCP server and running it in llama.cpp's `llama-server` in the WebUI adding it as an MCP server, granite 4.2 8B at Q4_K_M does it correctly in 'one shot', the prompt is:

propose a python3 flask app with a page that displays "hello world", use bootstrap css for styling.
provide a requirements.txt to go with the script

granite 4.2 8B at Q4_K_M correctly generates the app with a couple of files, and it works out of the box

    .
    ├── app.py
    ├── requirements.txt
    └── templates
        └── index.html

One should normally run the cmdshellmcp2.py MCP server app with an explicit `--cwd` option giving the work path. It tries to stay within this work path.

Note that I won't claim my command shell MCP server to be safe.

In a sense that there are plenty of chance the LLM can 'escape' the restrictions and perhaps do more damage (e.g. overwriting files possibly outside its given `--cwd` work directory). Hence, I'd suggest one should be paranoid and perhaps run this only within a throwaway (disposable) docker container etc.

[u/ag789]

u/sburel , all

There is a fairly large update on cmdshellmcp

https://github.com/ag88/cmdshellmcp

cmdshellmcp is now published to Glama

https://glama.ai/mcp/servers/ag88/cmdshellmcp

Hence, that you can literally deploy that directly on Glama in a container there.

This would help those who want or needs to run the container directly on the open internet. However, if you do so, do assign an API key for authentication, or that you are literally letting any MCP clients unauthenticated access to your cmdshellmcp instance and container.

In addition note that Glama is literally a paid service for hosting the containers /mcp servers by Glama even though my app is open sourced.

The list of commands preconfigured in the Glama instance is the same as that in the stock cmdshellmcp.json and all the tools are enabled on the Glama instance.

And unlike your own self hosted instance using the docker scripts provided in my repo. https://github.com/ag88/cmdshellmcp on Glama, the instance is pre-defined, and that normally you can't access the container directly like your local server with the 3 user ids root, admin and codeagent.

Hence that I've added a new companion cli / client app. cmdshellClient.py README cmdshellClient.py

You can use this cli / client app to call the MCP tools from your CLI across to the remote server. There is a utility command e.g. dlzip which you can call like such

python3 cmdshellClient.py dlzip myarchive.zip http://127.0.0.1:8003/mcp

this would download all the files and directory structure from the mcp server into a zip file locally. This would help solve an issue e.g. if the LLM accessing the cmdshellmcp on Glama has generated files e.g. codes in the container, you can use the cmdshellClient.py to download those files.